CVE-2026-2739

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published: Feb 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-273908.8Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ulti CVE-2026-273915.4Subscriber Broken Access Control in uListing <= 2.2.0 versions.CVE-2026-273924.3Contributor Broken Access Control in uListing <= 2.2.0 versions.CVE-2026-273935.3Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This CVE-2026-273959.8Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.CVE-2026-273967.3Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Securit CVE-2026-273976.5Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting In CVE-2026-273985.3Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security L CVE-2026-273995.3Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.CVE-2026-27408.4Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnera CVE-2026-274008.6Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.CVE-2026-274027.1Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.